VulnerabilityModified

CVE-2017-11671

MEDIUM 4.0EPSS 0.47%

Does this matter?

Lower severity and a low EPSS score (0.47%). Track it; it rarely justifies an emergency change on its own.

Description

Under certain circumstances, the ix86_expand_builtin function in i386.c in GNU Compiler Collection (GCC) version 4.6, 4.7, 4.8, 4.9, 5 before 5.5, and 6 before 6.4 will generate instruction sequences that clobber the status flag of the RDRAND and RDSEED intrinsics before it can be read, potentially causing failures of these instructions to go unreported. This could potentially lead to less randomness in random number generation.

CVSS 3.0: 4.0 MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.47% probability · 41th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-338
Affected: gnu/gcc
Source: cve@mitre.org

EPSS trend

EPSS 0.5% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

http://openwall.com/lists/oss-security/2017/07/27/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/100018Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:0849
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180Issue Tracking, Vendor Advisory
https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.htmlMailing List
http://openwall.com/lists/oss-security/2017/07/27/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/100018Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:0849
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80180Issue Tracking, Vendor Advisory
https://gcc.gnu.org/ml/gcc-patches/2017-03/msg01349.htmlMailing List

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.